From: Christopher Hoffman Date: Wed, 12 Feb 2025 16:27:35 +0000 (+0000) Subject: client: use fscrypt headers provided by linux X-Git-Url: http://git-server-git.apps.pok.os.sepia.ceph.com/?a=commitdiff_plain;h=62fd57c34fc7260e4f454ccc0c5d84f91d5baa83;p=ceph.git client: use fscrypt headers provided by linux Fixes: https://tracker.ceph.com/issues/68116 Signed-off-by: Christopher Hoffman --- diff --git a/src/client/fscrypt_uapi.h b/src/client/fscrypt_uapi.h index ede917061c6..507115a7251 100644 --- a/src/client/fscrypt_uapi.h +++ b/src/client/fscrypt_uapi.h @@ -7,73 +7,7 @@ */ #ifndef _UAPI_LINUX_FSCRYPT_H #define _UAPI_LINUX_FSCRYPT_H - -#include -#include - -/* Encryption policy flags */ -#define FSCRYPT_POLICY_FLAGS_PAD_4 0x00 -#define FSCRYPT_POLICY_FLAGS_PAD_8 0x01 -#define FSCRYPT_POLICY_FLAGS_PAD_16 0x02 -#define FSCRYPT_POLICY_FLAGS_PAD_32 0x03 -#define FSCRYPT_POLICY_FLAGS_PAD_MASK 0x03 -#define FSCRYPT_POLICY_FLAG_DIRECT_KEY 0x04 -#define FSCRYPT_POLICY_FLAG_IV_INO_LBLK_64 0x08 -#define FSCRYPT_POLICY_FLAG_IV_INO_LBLK_32 0x10 - -/* Encryption algorithms */ -#define FSCRYPT_MODE_AES_256_XTS 1 -#define FSCRYPT_MODE_AES_256_CTS 4 -#define FSCRYPT_MODE_AES_128_CBC 5 -#define FSCRYPT_MODE_AES_128_CTS 6 -#define FSCRYPT_MODE_SM4_XTS 7 -#define FSCRYPT_MODE_SM4_CTS 8 -#define FSCRYPT_MODE_ADIANTUM 9 -#define FSCRYPT_MODE_AES_256_HCTR2 10 -/* If adding a mode number > 10, update FSCRYPT_MODE_MAX in fscrypt_private.h */ - -/* - * Legacy policy version; ad-hoc KDF and no key verification. - * For new encrypted directories, use fscrypt_policy_v2 instead. - * - * Careful: the .version field for this is actually 0, not 1. - */ -#define FSCRYPT_POLICY_V1 0 -#define FSCRYPT_KEY_DESCRIPTOR_SIZE 8 -struct fscrypt_policy_v1 { - __u8 version; - __u8 contents_encryption_mode; - __u8 filenames_encryption_mode; - __u8 flags; - __u8 master_key_descriptor[FSCRYPT_KEY_DESCRIPTOR_SIZE]; -}; - -/* - * Process-subscribed "logon" key description prefix and payload format. - * Deprecated; prefer FS_IOC_ADD_ENCRYPTION_KEY instead. - */ -#define FSCRYPT_KEY_DESC_PREFIX "fscrypt:" -#define FSCRYPT_KEY_DESC_PREFIX_SIZE 8 -#define FSCRYPT_MAX_KEY_SIZE 64 -struct fscrypt_key { - __u32 mode; - __u8 raw[FSCRYPT_MAX_KEY_SIZE]; - __u32 size; -}; - -/* - * New policy version with HKDF and key verification (recommended). - */ -#define FSCRYPT_POLICY_V2 2 -#define FSCRYPT_KEY_IDENTIFIER_SIZE 16 -struct fscrypt_policy_v2 { - __u8 version; - __u8 contents_encryption_mode; - __u8 filenames_encryption_mode; - __u8 flags; - __u8 __reserved[4]; - __u8 master_key_identifier[FSCRYPT_KEY_IDENTIFIER_SIZE]; -}; +#include struct fscrypt_policy_arg { union { @@ -82,62 +16,6 @@ struct fscrypt_policy_arg { } policy; }; /* output */ -/* Struct passed to FS_IOC_GET_ENCRYPTION_POLICY_EX */ -struct fscrypt_get_policy_ex_arg { - __u64 policy_size; /* input/output */ - union { - __u8 version; - struct fscrypt_policy_v1 v1; - struct fscrypt_policy_v2 v2; - } policy; /* output */ -}; - -/* - * v1 policy keys are specified by an arbitrary 8-byte key "descriptor", - * matching fscrypt_policy_v1::master_key_descriptor. - */ -#define FSCRYPT_KEY_SPEC_TYPE_DESCRIPTOR 1 - -/* - * v2 policy keys are specified by a 16-byte key "identifier" which the kernel - * calculates as a cryptographic hash of the key itself, - * matching fscrypt_policy_v2::master_key_identifier. - */ -#define FSCRYPT_KEY_SPEC_TYPE_IDENTIFIER 2 - -/* - * Specifies a key, either for v1 or v2 policies. This doesn't contain the - * actual key itself; this is just the "name" of the key. - */ -struct fscrypt_key_specifier { - __u32 type; /* one of FSCRYPT_KEY_SPEC_TYPE_* */ - __u32 __reserved; - union { - __u8 __reserved[32]; /* reserve some extra space */ - __u8 descriptor[FSCRYPT_KEY_DESCRIPTOR_SIZE]; - __u8 identifier[FSCRYPT_KEY_IDENTIFIER_SIZE]; - } u; -}; - -/* - * Payload of Linux keyring key of type "fscrypt-provisioning", referenced by - * fscrypt_add_key_arg::key_id as an alternative to fscrypt_add_key_arg::raw. - */ -struct fscrypt_provisioning_key_payload { - __u32 type; - __u32 __reserved; - __u8 raw[]; -}; - -/* Struct passed to FS_IOC_ADD_ENCRYPTION_KEY */ -struct fscrypt_add_key_arg { - struct fscrypt_key_specifier key_spec; - __u32 raw_size; - __u32 key_id; - __u32 __reserved[8]; - __u8 raw[]; -}; - /* Struct passed to FS_IOC_ADD_ENCRYPTION_KEY */ struct fscrypt_add_key64_arg { struct fscrypt_key_specifier key_spec; @@ -147,69 +25,7 @@ struct fscrypt_add_key64_arg { __u8 raw[64]; }; -/* Struct passed to FS_IOC_REMOVE_ENCRYPTION_KEY */ -struct fscrypt_remove_key_arg { - struct fscrypt_key_specifier key_spec; -#define FSCRYPT_KEY_REMOVAL_STATUS_FLAG_FILES_BUSY 0x00000001 -#define FSCRYPT_KEY_REMOVAL_STATUS_FLAG_OTHER_USERS 0x00000002 - __u32 removal_status_flags; /* output */ - __u32 __reserved[5]; -}; - -/* Struct passed to FS_IOC_GET_ENCRYPTION_KEY_STATUS */ -struct fscrypt_get_key_status_arg { - /* input */ - struct fscrypt_key_specifier key_spec; - __u32 __reserved[6]; - - /* output */ -#define FSCRYPT_KEY_STATUS_ABSENT 1 -#define FSCRYPT_KEY_STATUS_PRESENT 2 -#define FSCRYPT_KEY_STATUS_INCOMPLETELY_REMOVED 3 - __u32 status; -#define FSCRYPT_KEY_STATUS_FLAG_ADDED_BY_SELF 0x00000001 - __u32 status_flags; - __u32 user_count; - __u32 __out_reserved[13]; -}; - -#define FS_IOC_SET_ENCRYPTION_POLICY _IOR('f', 19, struct fscrypt_policy_v1) -#define FS_IOC_SET_ENCRYPTION_POLICY_RESTRICTED _IOWR('f', 19, struct fscrypt_policy_arg) -#define FS_IOC_GET_ENCRYPTION_PWSALT _IOW('f', 20, __u8[16]) -#define FS_IOC_GET_ENCRYPTION_POLICY _IOW('f', 21, struct fscrypt_policy_v1) -#define FS_IOC_GET_ENCRYPTION_POLICY_EX _IOWR('f', 22, __u8[9]) /* size + version */ -#define FS_IOC_GET_ENCRYPTION_POLICY_EX_RESTRICTED _IOWR('f', 22, struct fscrypt_get_policy_ex_arg) /* size + version */ -#define FS_IOC_ADD_ENCRYPTION_KEY _IOWR('f', 23, struct fscrypt_add_key_arg) -#define FS_IOC_ADD_ENCRYPTION_KEY64 _IOWR('f', 23, struct fscrypt_add_key64_arg) -#define FS_IOC_REMOVE_ENCRYPTION_KEY _IOWR('f', 24, struct fscrypt_remove_key_arg) -#define FS_IOC_REMOVE_ENCRYPTION_KEY_ALL_USERS _IOWR('f', 25, struct fscrypt_remove_key_arg) -#define FS_IOC_GET_ENCRYPTION_KEY_STATUS _IOWR('f', 26, struct fscrypt_get_key_status_arg) -#define FS_IOC_GET_ENCRYPTION_NONCE _IOR('f', 27, __u8[16]) - -/**********************************************************************/ - -/* old names; don't add anything new here! */ -#ifndef __KERNEL__ -#define fscrypt_policy fscrypt_policy_v1 -#define FS_KEY_DESCRIPTOR_SIZE FSCRYPT_KEY_DESCRIPTOR_SIZE -#define FS_POLICY_FLAGS_PAD_4 FSCRYPT_POLICY_FLAGS_PAD_4 -#define FS_POLICY_FLAGS_PAD_8 FSCRYPT_POLICY_FLAGS_PAD_8 -#define FS_POLICY_FLAGS_PAD_16 FSCRYPT_POLICY_FLAGS_PAD_16 -#define FS_POLICY_FLAGS_PAD_32 FSCRYPT_POLICY_FLAGS_PAD_32 -#define FS_POLICY_FLAGS_PAD_MASK FSCRYPT_POLICY_FLAGS_PAD_MASK -#define FS_POLICY_FLAG_DIRECT_KEY FSCRYPT_POLICY_FLAG_DIRECT_KEY -#define FS_POLICY_FLAGS_VALID 0x07 /* contains old flags only */ -#define FS_ENCRYPTION_MODE_INVALID 0 /* never used */ -#define FS_ENCRYPTION_MODE_AES_256_XTS FSCRYPT_MODE_AES_256_XTS -#define FS_ENCRYPTION_MODE_AES_256_GCM 2 /* never used */ -#define FS_ENCRYPTION_MODE_AES_256_CBC 3 /* never used */ -#define FS_ENCRYPTION_MODE_AES_256_CTS FSCRYPT_MODE_AES_256_CTS -#define FS_ENCRYPTION_MODE_AES_128_CBC FSCRYPT_MODE_AES_128_CBC -#define FS_ENCRYPTION_MODE_AES_128_CTS FSCRYPT_MODE_AES_128_CTS -#define FS_ENCRYPTION_MODE_ADIANTUM FSCRYPT_MODE_ADIANTUM -#define FS_KEY_DESC_PREFIX FSCRYPT_KEY_DESC_PREFIX -#define FS_KEY_DESC_PREFIX_SIZE FSCRYPT_KEY_DESC_PREFIX_SIZE -#define FS_MAX_KEY_SIZE FSCRYPT_MAX_KEY_SIZE -#endif /* !__KERNEL__ */ - -#endif /* _UAPI_LINUX_FSCRYPT_H */ +#define FS_IOC_SET_ENCRYPTION_POLICY_RESTRICTED _IOWR('f', 19, struct fscrypt_policy_arg) +#define FS_IOC_GET_ENCRYPTION_POLICY_EX_RESTRICTED _IOWR('f', 22, struct fscrypt_get_policy_ex_arg) /* size + version */ +#define FS_IOC_ADD_ENCRYPTION_KEY64 _IOWR('f', 23, struct fscrypt_add_key64_arg) +#endif